-- tvitch.lua - example wireshark dissector total view protocol
-- this example is based on tutorial by Stig Bj?rlykke.
-- for more information on how to write dissectors, post dissectors, and listeners see
-- http://www.cacetech.com/sharkfest.09/DT06_Bjorlykke_Lua%20Scripting%20in%20Wireshark.pdf

do
    -- create the dissector
    local tvitch = Proto("tvitch", "Dissector for TotalView-ITCH over UDP")

    -- here we place one time initialization code
    function tvitch.init()
    end

    -- field definitions for our protocol that tell
    -- wireshark how to parse and display chunks of data
    local f = tvitch.fields
    f.message_type = ProtoField.uint8("tvitch.message_type", "Message Type", base.HEX, {[string.byte("A", 1)] = "Add Order"}, 0xff, "No MPID Attribution Message")
    f.timestamp_nanoseconds = ProtoField.uint32("tvitch.timestamp_nanoseconds", "Timestamp-Nanoseconds", base.DEC)
    f.order_ref_number = ProtoField.uint64("tvitch.order_ref_number", "Order Reference Number", base.DEC)
    f.buy_sell_indicator = ProtoField.uint8(
    	"tvitch.buy_sell_indicator", 
	"Buy/Sell Indicator", 
	base.HEX, 
	{[string.byte("B", 1)] = "Buy Order", [string.byte("S", 1)] = "Sell Order"}, 
	0xff, 
	"The type of order being added")
    f.shares = ProtoField.uint32("tvitch.shares", "shares", base.DEC)
    f.stock = ProtoField.string("tvitch.stock", "Stock", base.DEC)
    f.price = ProtoField.uint32("tvitch.price", "price", base.DEC)

    -- the dissector function is called for each captured packet
    -- for protocol that we subscribed 
    function tvitch.dissector(buffer, pinfo, tree)
        -- Adding fields to the tree
        local subtree = tree:add(tvitch, buffer())
        local offset = 0
        local message_type = buffer(offset, 1)
        subtree:add(f.message_type, message_type)
        local timestamp_nanoseconds = buffer(offset + 1, 4)
        subtree:add(f.timestamp_nanoseconds, timestamp_nanoseconds)
	local order_ref_number = buffer(offset + 5, 4)
        subtree:add(f.order_ref_number, order_ref_number)
	local buy_sell_indicator = buffer(offset + 13, 1)
        subtree:add(f.buy_sell_indicator, buy_sell_indicator)
	local shares = buffer(offset + 14, 4)
        subtree:add(f.shares, shares)
	local stock = buffer(offset + 18, 6)
        subtree:add(f.stock, stock)
	local price = buffer(offset + 24, 4)
        subtree:add(f.price, price)
    end

    -- subscribe for UDP packets on port 31035
    local udp_table = DissectorTable.get("udp.port")
    udp_table:add(31035, tvitch)
end

